wolfhsm 0.2.0

//! wolfHSM integration tests.
//!
//! These tests require a running wolfHSM server.  Set the `WOLFHSM_SERVER`
//! environment variable to the server address before running:
//!
//! - `/path/to/socket` — Unix Domain Socket (path starts with `/`)
//! - `host:port`       — TCP (e.g. `127.0.0.1:8080`)
//!
//! Every test silently returns (is skipped) when `WOLFHSM_SERVER` is unset.

use hex_literal::hex;
use wolfhsm::crypto::rsa::RsaRawOp;
use wolfhsm::nvm::NvmId;
use wolfhsm::{Client, Transport, Error};

// ── Server connection helper ──────────────────────────────────────────────────

fn connect_or_skip() -> Option<Client> {
    let server = std::env::var("WOLFHSM_SERVER").ok()?;
    let transport = if server.starts_with('/') {
        Transport::Uds { path: server }
    } else {
        let (ip, port_str) = server.rsplit_once(':')?;
        let port: u16 = port_str.parse().ok()?;
        Transport::Tcp {
            ip: ip.to_string(),
            port,
        }
    };
    Client::connect(transport, 1).ok()
}

/// Early-return (skip) the test if `WOLFHSM_SERVER` is not set.
macro_rules! require_client {
    ($name:ident) => {
        let mut $name = match connect_or_skip() {
            Some(c) => c,
            None => return,
        };
    };
}

// ── Connectivity ──────────────────────────────────────────────────────────────

#[test]
fn connect_echo() {
    require_client!(client);
    let msg = b"hello wolfhsm";
    let mut buf = [0u8; 32];
    let n = client.echo(msg, &mut buf).expect("echo");
    assert_eq!(&buf[..n], msg);
}

#[test]
fn server_info() {
    require_client!(client);
    let info = client.info().expect("info");
    // Any real wolfHSM server reports a non-zero version or build number.
    assert!(
        info.version > 0 || info.build > 0,
        "server returned all-zero version/build: {info:?}",
    );
}

// ── RNG ───────────────────────────────────────────────────────────────────────

#[test]
fn rng_nonzero() {
    require_client!(client);
    let bytes = client.rng_generate(32).expect("rng generate");
    assert_eq!(bytes.len(), 32);
    // 32 random bytes that are all-zero indicates a broken RNG.
    assert_ne!(bytes, vec![0u8; 32], "RNG returned 32 zero bytes");
}

// ── Key cache ─────────────────────────────────────────────────────────────────

#[test]
fn with_key_lifecycle() {
    require_client!(client);
    client
        .with_aes_key(&[0u8; 32], |_, _| Ok(()) as Result<(), Error>)
        .expect("with_aes_key lifecycle");
}

// ── NVM ───────────────────────────────────────────────────────────────────────

// Each test uses a distinct NVM ID to avoid interference when tests run in parallel.
const NVM_ID_RW: NvmId = NvmId::new(0x4242);
const NVM_ID_LIST: NvmId = NvmId::new(0x4244);

#[test]
fn nvm_available_returns_space() {
    require_client!(client);
    let avail = client.nvm_available().expect("nvm_available");
    // Sanity check: the server reports some available or reclaimable space.
    assert!(
        avail.avail_size > 0 || avail.reclaim_size > 0,
        "NVM reports no space at all: {avail:?}",
    );
}

#[test]
fn nvm_overwrite_read_delete() {
    require_client!(client);
    let data = b"integration test payload";
    // Remove any leftover object from a previous failed run.
    let _ = client.nvm_delete(NVM_ID_RW);
    client
        .nvm_overwrite(NVM_ID_RW, 0, 0, b"test", data)
        .expect("nvm_overwrite");
    let read = client.nvm_read(NVM_ID_RW, 0).expect("nvm_read");
    assert_eq!(read, data);
    client.nvm_delete(NVM_ID_RW).expect("nvm_delete");
}

#[test]
fn nvm_list_contains_written_object() {
    require_client!(client);
    let _ = client.nvm_delete(NVM_ID_LIST);
    client
        .nvm_overwrite(NVM_ID_LIST, 0, 0, b"list-test", b"payload")
        .expect("nvm_overwrite");
    let ids = client.nvm_list().expect("nvm_list");
    assert!(
        ids.contains(&NVM_ID_LIST),
        "written NVM ID not found in list: {ids:?}",
    );
    client.nvm_delete(NVM_ID_LIST).expect("nvm_delete cleanup");
}

// ── Counter ───────────────────────────────────────────────────────────────────

const COUNTER_ID: NvmId = NvmId::new(0x4243);

#[test]
fn counter_lifecycle() {
    require_client!(client);
    // Remove any leftover counter from a previous failed run.
    let _ = client.counter_destroy(COUNTER_ID);

    let v0 = client.counter_init(COUNTER_ID, 5).expect("counter_init");
    assert_eq!(v0, 5);

    let v1 = client
        .counter_increment(COUNTER_ID)
        .expect("counter_increment");
    assert_eq!(v1, 6);

    let v2 = client.counter_read(COUNTER_ID).expect("counter_read");
    assert_eq!(v2, 6);

    let v3 = client.counter_reset(COUNTER_ID).expect("counter_reset");
    assert_eq!(v3, 0);

    client.counter_destroy(COUNTER_ID).expect("counter_destroy");
}

// ── SHA-256 (NIST FIPS 180-4) ─────────────────────────────────────────────────

#[test]
fn sha256_nist_abc() {
    require_client!(client);
    // NIST FIPS 180-4 SHA-256("abc")
    let expected = hex!("ba7816bf8f01cfea414140de5dae2ec73b00361bbef0469121b9e42a45b6b0d5");
    let got = client.sha256(b"abc").expect("sha256");
    assert_eq!(got, expected);
}

// ── CMAC (NIST SP 800-38B, Example 1) ────────────────────────────────────────

#[test]
fn cmac_nist_empty_message() {
    require_client!(client);
    // NIST SP 800-38B AES-128 CMAC, Key1, empty message → Example 1
    let key_bytes = hex!("2b7e151628aed2a6abf7158809cf4f3c");
    let expected = hex!("bb1d6929e95937287fa37d129b756746");
    let tag = client
        .with_cmac_key(&key_bytes, |key, client| key.compute(client, b""))
        .expect("cmac compute");
    assert_eq!(tag, expected);
}

// ── AES-GCM (NIST SP 800-38D, Test Case 13) ──────────────────────────────────

#[test]
fn aes_gcm_nist_empty_plaintext() {
    require_client!(client);
    // NIST SP 800-38D AES-256-GCM test case 13:
    //   Key = 0x00…00 (32 bytes), IV = 0x00…00 (12 bytes), PT/AAD = empty
    //   Expected AT = 530f8afbc74536b9a963b4f1c4cb738b
    let key_bytes = [0u8; 32];
    let iv = [0u8; 12];
    let expected_tag = hex!("530f8afbc74536b9a963b4f1c4cb738b");

    let (ct, tag) = client
        .with_aes_key(&key_bytes, |key, client| key.gcm_encrypt(client, &iv, &[], &[]))
        .expect("aes gcm_encrypt");

    assert!(ct.is_empty(), "ciphertext of empty plaintext must be empty");
    assert_eq!(tag, expected_tag);
}

// ── ECC P-256: sign/verify cross-validation ───────────────────────────────────
//
// wolfHSM signs a SHA-256 digest; the p256 crate independently verifies.

#[test]
fn ecc_p256_sign_verify_cross() {
    require_client!(client);
    use p256::ecdsa::signature::hazmat::PrehashVerifier;
    use p256::ecdsa::{Signature, VerifyingKey};
    use p256::pkcs8::DecodePublicKey;
    use sha2::{Digest, Sha256};

    let msg = b"cross-validation: wolfhsm signs, p256 verifies";
    let digest: [u8; 32] = Sha256::digest(msg).into();

    let (sig_der, pub_der) = client
        .with_ecc_p256_key(|key, client| {
            let sig_der = key.sign_digest(client, &digest)?;
            let pub_der = key.public_key_der(client)?;
            Ok((sig_der, pub_der))
        })
        .expect("ecc sign+export");

    let vk =
        VerifyingKey::from_public_key_der(&pub_der).expect("p256: parse SubjectPublicKeyInfo DER");
    let sig = Signature::from_der(&sig_der).expect("p256: parse DER-encoded ECDSA signature");
    vk.verify_prehash(&digest, &sig)
        .expect("p256: verify_prehash failed — wolfhsm/p256 cross-validation error");
}

// ── ECC P-256: ECDH cross-validation ─────────────────────────────────────────
//
// wolfHSM computes ECDH with a p256-generated public key; the p256 crate
// computes ECDH from the other direction; shared secrets must agree.

#[test]
fn ecc_p256_ecdh_cross() {
    require_client!(client);
    use p256::pkcs8::{DecodePublicKey, EncodePublicKey};
    use p256::{ecdh::EphemeralSecret, PublicKey};
    use rand::rngs::OsRng;

    // Local side: generate a p256 ephemeral key pair.
    let local_secret = EphemeralSecret::random(&mut OsRng);
    let local_pub_key = local_secret.public_key();
    let local_pub_der = local_pub_key
        .to_public_key_der()
        .expect("p256: encode SubjectPublicKeyInfo DER");

    // HSM side: ECDH + export public key inside the closure.
    let (hsm_shared, hsm_pub_der) = client
        .with_ecc_p256_key(|key, client| {
            let hsm_shared = key.ecdh(client, local_pub_der.as_bytes())?;
            let hsm_pub_der = key.public_key_der(client)?;
            Ok((hsm_shared, hsm_pub_der))
        })
        .expect("ecc ecdh+export");

    // Local side: ECDH with the HSM public key.
    let hsm_public = PublicKey::from_public_key_der(&hsm_pub_der)
        .expect("p256: parse HSM SubjectPublicKeyInfo DER");
    let local_shared = local_secret.diffie_hellman(&hsm_public);

    assert_eq!(
        hsm_shared.as_slice(),
        local_shared.raw_secret_bytes().as_slice(),
        "ECDH shared secrets do not match",
    );
}

// ── Ed25519: sign/verify cross-validation ─────────────────────────────────────
//
// wolfHSM signs; ed25519-dalek independently verifies.

#[test]
fn ed25519_sign_verify_cross() {
    require_client!(client);
    use ed25519_dalek::{Signature, Verifier, VerifyingKey};

    let msg = b"cross-validation: wolfhsm signs, ed25519-dalek verifies";

    let (sig_bytes, pub_bytes) = client
        .with_ed25519_key(|key, client| {
            let sig_bytes = key.sign(client, msg)?;
            let pub_bytes = key.public_key(client)?;
            Ok((sig_bytes, pub_bytes))
        })
        .expect("ed25519 sign+export");

    let vk = VerifyingKey::from_bytes(&pub_bytes).expect("ed25519-dalek: parse public key bytes");
    let sig = Signature::from_bytes(&sig_bytes);
    vk.verify(msg, &sig)
        .expect("ed25519-dalek: verify failed — wolfhsm/ed25519-dalek cross-validation error");
}

// ── Curve25519 / X25519: ECDH cross-validation ───────────────────────────────
//
// wolfHSM computes DH with an x25519-dalek public key; the dalek crate computes
// DH from the other direction; shared secrets must agree.

#[test]
fn curve25519_x25519_ecdh_cross() {
    require_client!(client);
    use rand::rngs::OsRng;
    use x25519_dalek::{PublicKey, StaticSecret};

    // Local side: generate an x25519 static secret.
    let local_secret = StaticSecret::random_from_rng(OsRng);
    let local_public = PublicKey::from(&local_secret);

    // HSM side: DH + export public key inside the closure.
    let (hsm_shared, hsm_pub_bytes) = client
        .with_curve25519_key(|key, client| {
            let hsm_shared = key.diffie_hellman(client, local_public.as_bytes())?;
            let hsm_pub_bytes = key.public_key(client)?;
            Ok((hsm_shared, hsm_pub_bytes))
        })
        .expect("curve25519 dh+export");

    // Local side: DH with the HSM public key.
    let hsm_public = PublicKey::from(hsm_pub_bytes);
    let local_shared = local_secret.diffie_hellman(&hsm_public);

    assert_eq!(
        hsm_shared,
        *local_shared.as_bytes(),
        "X25519 shared secrets do not match",
    );
}

// ── RSA: encrypt/decrypt; PublicEncrypt cross-validated against pure Rust ────

#[test]
fn rsa_round_trip() {
    require_client!(client);
    use rsa::{pkcs8::DecodePublicKey, traits::PublicKeyParts, BigUint, RsaPublicKey};

    // RSA-1024 for faster key generation during testing.
    // All operations happen inside the closure; return the values needed for
    // the pure-Rust cross-validation.
    let (msg, pub_der, ciphertext, plaintext) = client
        .with_rsa_key(1024, 65537, |key, client| {
            let key_size = key.key_size_bytes() as usize;
            // Build a valid raw RSA input: zero-padded, small value, guaranteed < n.
            let mut msg = vec![0u8; key_size];
            msg[key_size - 1] = 0x42;
            let pub_der = key.public_key_der(client)?;
            let ciphertext = key.raw_op(client, RsaRawOp::PublicEncrypt, &msg)?;
            let plaintext = key.raw_op(client, RsaRawOp::PrivateDecrypt, &ciphertext)?;
            Ok((msg, pub_der, ciphertext, plaintext))
        })
        .expect("rsa operations");

    // Cross-validate PublicEncrypt against pure Rust: export the public key
    // (n, e) and independently compute m^e mod n.  This ensures the HSM
    // produces a standard RSA result, not merely one it can reverse itself.
    let key_size = msg.len();
    let pub_key = RsaPublicKey::from_public_key_der(&pub_der).expect("parse public key DER");
    let m_big = BigUint::from_bytes_be(&msg);
    let c_expected = m_big.modpow(pub_key.e(), pub_key.n());
    // BigUint strips leading zeros; restore to key length.
    let mut c_expected_bytes = c_expected.to_bytes_be();
    while c_expected_bytes.len() < key_size {
        c_expected_bytes.insert(0, 0);
    }
    assert_eq!(
        ciphertext, c_expected_bytes,
        "HSM PublicEncrypt mismatch vs pure-Rust m^e mod n"
    );

    assert_eq!(plaintext, msg, "RSA round-trip plaintext mismatch");
}

// ── ML-DSA: sign/verify round-trip (no independent oracle; feature-gated) ─────

#[cfg(feature = "mldsa")]
#[test]
fn mldsa_round_trip() {
    require_client!(client);
    let msg = b"ML-DSA level-44 round-trip test";
    client
        .with_mldsa_key(44, |key, client| {
            let sig = key.sign(client, msg)?;
            key.verify(client, msg, &sig)
        })
        .expect("mldsa round-trip");
}

// ── CryptoCb: registration / guard lifecycle ─────────────────────────────────
//
// Verifies the RAII guard prevents double-registration and correctly
// unregisters on drop.  Requires two separate Client connections.

#[test]
fn cryptocb_register_lifecycle() {
    let mut client1 = match connect_or_skip() {
        Some(c) => c,
        None => return,
    };
    let mut client2 = match connect_or_skip() {
        Some(c) => c,
        None => return,
    };

    // First registration succeeds.
    let guard1 = client1.register_cryptocb().expect("first registration");

    // While guard1 is alive, a second registration must be rejected.
    match client2.register_cryptocb() {
        Err(Error::AlreadyRegistered) => {}
        Err(e) => panic!("expected AlreadyRegistered, got Err: {e}"),
        Ok(_) => panic!("expected Err(AlreadyRegistered), got Ok"),
    }

    // Dropping the guard unregisters; client2 can now register.
    drop(guard1);
    let guard2 = client2
        .register_cryptocb()
        .expect("re-registration after guard drop");
    drop(guard2);
}